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Abstract — We propose the notion of secrecy gain as a code 
design criterion for wiretap lattice codes to be used over an 
additive white Gaussian noise channel. Our analysis relies on 
the error probabilites of both the legitimate user and the 
eavesdropper. We focus on geometrical properties of lattices, 
described by their theta series, to characterize good wiretap 
codes. 

I. Introduction 

The wiretap channel was introduced by Wyner iflOl as a dis- 
crete memoryless broadcast channel where the sender, Alice, 
transmits confidential messages to a legal receiver Bob, in the 
presence of an eavesdropper Eve. Wyner defined the perfect 
secrecy capacity as the maximum amount of information that 
Alice can send to Bob while insuring that Eve gets a neg- 
ligeable amount of information. He also described a generic 
coding strategy known as coset coding. While coset coding has 
been used in many coding scenarios (for ex. [11 1, [8|), Wyner 
used it to encode both data and random bits to confuse the 
eavesdropper. A more precise coset coding technique, called 
wiretap II codes, was presented in [7|, where Alice enjoys a 
noiseless channel while Eve has to deal with a channel with 
erasures. The question of determining the secrecy capacity 
of many classes of channels has been addressed extensively 
recently, yielding a plethora of information theoretical results 
on secrecy capacity. 

There is a sharp contrast with the situation of wiretap 
code designs, where very little is known. The most exploited 
approach to get practical codes so far has been to use LDPC 
codes (for example |9j for binary erasure and symmetric 
channels, [5 1 for Gaussian channels). We also note that wiretap 
II codes have been extended to more general settings such 
as network coding in Q. Finally, lattice codes for Gaussian 
channels have been considered from an information theoretical 
point of view in |4|. 

The problem that we address in this paper is to propose 
a design criterion for constructing explicit lattice codes (of 
possibly small length) to be used over additive white Gaussian 
noise channels. Assuming that Eve's channel is worse than the 
one of Alice, we analyse the probability of both users to make 
a correct decision, and exhibit geometrical lattice properties 
that maximize Alice's probability of making the right decision, 
while minimizing Eve's probability of decoding successfully. 
These properties are captured by the theta series of the lattice 



used for encoding, which in turn is used to define the notion 
of secrecy gain as a measure of secrecy brough by the lattice 
wiretap codes. Note that we do not consider a binary input as 
proposed in 0. 

The paper is organized as follows. In Section HU we first 
describe a coset coding strategy suitable for lattices, namely 
using coset lattice codes. The corresponding decoding strategy 
is described in Section [HI] The chore results are given in 
Section [IV] Bob's and Eve's probability of decoding coset 
lattice codes are computed, and we show that the behaviour 
of its theta series captures what makes a lattice good for being 
a wiretap code, motivating the introduction of the notion of 
secrecy gain. 

II. Wiretap Lattice Encoding 

We consider a Gaussian wiretap channel, namely a broad- 
cast channel where the source (Alice) sends a signal to a 
legitimate receiver (Bob), while an illegitimate eavesdropper 
(Eve) can listen to the transmission. It is modeled by 
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where x is the transmitted signal, v\> and v e denote the 
Gaussian noise at Bob, respectively Eve's side, both with zero 
mean, and respective variance a\ and a^. We assume that Bob 
has a good SNR, but that a\ — N « Ni — a\, so that Eve 
has a poor SNR, in particular with respect to Bob. 

Alice's encoder maps k information symbols si,...,s& 
from S = {0,1} to a codeword x = [x\, . . . ,x n ) £ t™, 
and over a transmission of n symbols, we get 
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Alice uses lattice coding, that is the codeword x = 
(x-y, . . . ,x n ) is actually a lattice point. A lattice A is a discrete 
set of points in W\ which can be described in terms of its 
generator matrix M by (0, (H) 



A = {x = uM | u e IT 1 }, 



where 
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and 

vi = {vu,Vi2,...,V ln ), 
V2 = («21,«22,...,U2n), 

Vm — (^ml ) ^m2 ) * • • ) ^mn) : 

are a linearly independent set of vectors in M ra (so that m < n) 
which form a basis of the lattice. 

Alice chooses a lattice A& (we use the subscript b to refer 
to the intended legimitate receiver Bob) and then encodes her 
k bits of information into a point x£ Aj,: 

s = (ax,.. ■ ,s fe ) G {0, l} fe x = (xx,.-.,x n ) £ A b . 

In a practical scenario, a finite subset of A& must be chosen 
as a function of the available power at the receiver, though for 
the analysis, we will often consider the infinite lattice, which 
is simpler to understand since we do not need to take into 
account the boundary effect. 

In order to get confusion at the eavesdropper, we use coset 
coding, as proposed in [ 10 1, |7|. The idea (which has been used 
ever since, whenever there is wiretap coding) is that instead of 
having a one-to-one correspondence between s £ {0, l} fc o 
x e Ab, the vector of information symbols is mapped to a set 
of codewords, namely a coset (that is, a set of points obtained 
by translation of a lattice), after which a random point to be 
actually transmitted is chosen randomly inside the coset. More 
precisely, we partition the lattice A& into a union of disjoint 
cosets of the form 

A e + c, 

with A e a sublattice of Ab and c an n-dimensional vector not 
in A e . We need 2 k cosets to be labelled by s e {0, l} fc : 

A b = U 2 =1 (A e + Cj ). 

Since every coset contains the same number of elements, we 
have that 

|A 6 /A e | = 2 k . (2) 

Once the mapping 

s h-> A e + Cj( s ) 

is done, Alice randomly chooses a point x e A e + c_y( s ) and 
sends it over the wiretap channel. This is equivalent to choose 
a random vector r <E A e . The transmitted lattice point x£ Aj 
is finally of the form 

x = r + c £ A e + c. (3) 

We have denoted the sublattice A e , since it encodes the random 
bits that are there to increase Eve's confusion, and is then the 
lattice intended for Eve. 

Example 1: Take Ab = Z 2 in R 2 and A e = 2Z 2 , for which 
we have 

^ 2 = {(x,y), x,y e 1} 

= 21? U (21? + (0, 1)) U (2Z 2 + (1, 0)) U (2Z 2 + (1, 1)). 



The lattice Z 2 is thus partionned into 2 fe = 4 cosets, allowing 
to transmit k = 2 bits of information. Alice can then label any 
of the above 4 cosets, say 

00^2Z 2 , 01i-> (2Za + (0,l)), 

10 m. (2Z 2 + (1,0)), 11 (->• (2Z 2 + (1, 1)). 

To transmit the two bits 01, she then randomly picks a point 
in the coset 2Z 2 + (0, 1), say x = (2, 3), that is 

x = r + c = 2(1,1) + (0,1), 

and sends this point over the wiretap channel. 

By using lattice coset encoding, we notice that two lattices 
play a role: 

• the lattice A&, that Alice uses to communicate reliably 
with Bob, 

• the lattice A e , which is a sublattice of Ab, that appears 
in the process of coset coding for encoding random bits. 

Our goal is to study how the properties of these two lattices 
are related to the design of good wiretap codes. 

III. Wiretap Lattice Decoding 

After transmission over the Gaussian wiretap channel, Bob 
and Eve receive respectively (see (Q~|i and (01) 

y = x + Vb =r + c + v 5 
z = x + v e = r + c + v e , 

where we recall that r £ A e encodes the random bits, and c 
is the coset representative of minimum energy labelled by the 
information bits. Both Bob and Eve are interested in decoding 
the information bits, namely in finding the correct coset that 
was sent. To do so, they need to find the closest lattice point 
in Ab to their respective received signal y or z, from which 
they deduce the coset to which it corresponds. 

Recall that for any lattice point Pi of a lattice A C K n , its 
Voronoi cell is defined by 

V(Pi) = {x £ W\ d(x, Pi) < d(x, Pj) for all j}. 

Since all lattice points have the same Voronoi cell, we will 
speak of the Voronoi cell of the lattice A and denote it by 
V(A). 

Now when transmitting a codeword x^ in R" with Voronoi 
cell V(xfc) over an additive white Gaussian noise channel with 
noise variance a 2 , the decoder makes the correct decision if 
and only if the noise vector is in V(xfe), an event of probability 

— jL- / e -n u n 2 / 2 - 2 du. 

In our scenario, the probability P c of correct decision concerns 
not just one point but a coset, and thus it is the probability that 
the received signal lies in the union of the Voronoi regions of 
Ab, translated by points of A e . Suppose that the lattice point 
x/s = Tfc+Cfc G Ab has been transmitted. The probability P c of 
finding the correct coset is thus, assuming no boundary effect 

p c = L_ y [ e-n u n 2 / 2CT2 du. 



If we take M codewords xi , . . . , xm from A&, then as 
already noticed, all Voronoi cells are the same, namely 
V(xfc) = V(A), k — 1, . . . , M, and thus we get 

P c = I e-H u H 2 / 2CT2 du. (4) 

IV. Wiretap Lattice Code Design 

We now study the probability of Bob and Eve to make 
a correct decoding decision, and try to maximize Bob's 
probability while minimizing the one of Eve. This leads us 
to study the theta series of the lattices involved. 

A. A first analysis 

Considering the wiretap channel (0 where Alice transmits 
lattice codewords from an n-dimensional lattice A&, we thus 
get from that the probability P Cj (, of Bob's (resp. P c e of 
Eve's) correct decision is: 
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Since by assumption Bob has a good SNR, its received 
vector y is most likely to lie in the Voronoi region around 
the origin, and thus the terms corresponding to r ^ in (0]l 
are negligeable, which yields: 

Pr.,b^ , j- - I e-" U " 2 / 2CT 'du. (5) 



(V27T(7 b )™ Jv(A b ) 

This is now the familiar case of transmitting lattice points over 
the Gaussian channel, for which it is known that At should 
have a good Hermite parameter, to get a good coding gain. 

We are on the contrary under a low SNR assumption for 
Eve, namely er e is large, and thus a Taylor expansion at order 
gives 

e H|w+r|| 2 /2<r 2 = e -||r|| 2 /2<r 2 + Q ( —, 



so that 



e -||u|| 2 /2 CT 2 du 



e -||w +r || 2 /2 CT 2 dw 

V(A 6 )+r JV(A b ) 

~ Vol(V(A h ))e-ll r ll 2 / 2ff2 , 
where the volume V(A{,) of the lattice is 

Vol(V(A)) = f dx = det(MM T ) 1 / 2 . 
The probability of making a correct decision for Eve is then 

Pc ' e * , FT ,n Vol ( V ( A ")) E e - |M|2/2CT % (6) 



from which we get that 



-||r|| 2 /2<7 2 



(7) 



We know how to design good codes for Bob's channel, and 
have his probability of making a correct decision arbitrarily 
close to 1. Our aim is thus to minimize the probability P c e of 
Eve making a correct decision, while keeping P Cj (, unchanged. 
This is equivalent to minimize 0, that is to find a lattice A& 
which is as good as possible for the Gaussian channel [1], and 



minimize X)reA e " r " ^ 2a " 
under the constraint log 2 |A&/A e | = k. 



(8) 



^ e -||r|| 2 /2 CT 2 
reA„ 



The constraint on the cardinality of cosets (or rate) is equiva- 
lent to set the fundamental volume of A e equal to a constant. 

It is natural to start by approximating the sum of exponen- 
tials by its terms of higher order, namely 

1+ y e -\\rf/^l 

reA e ,||r||=d min (A c ) 

l + T(A e ) e - d ™^> 2 / 2 - 2 , 

where r(A e ) is the kissing number of A e which counts 
the number of vectors of length <i m i n (A e ). Thus as a first 
criterion, we should maximize d m i n (A e ) while preserving the 
fundamental volume of A e , which is equivalent to require for 
A e to have a good Hermite parameter 



Iff (A) = 



<in(A) 



det(MM T )!/«' 

after which we should minimize its kissing number. This 
approximation however assumes high SNR, which typically 
Eve does not have. We thus cannot be content with this 
approximation, and have to obtain a more precise analysis. 

B. The secrecy gain 

Let us get back to the code design criterion dHJ and rewrite 
it in terms of the theta serie of the lattice considered. 

Recall that given a lattice A C K™, its theta serie 0a is 
defined by (Q) 



e A (z) = y 



q = e" 2 ,Ini(z) > 0. 



(9) 



Exceptional lattices have theta series that can be expressed 
as functions of the Jacobi theta functions $i(q), i = 2,3,4, 
themselves defined by 
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Example 2: Here are a few examples of theta series for 
some exceptional lattices. 
1) The cubic lattice Z": 

ez»(g) = 3 (ff) n . 



2) D Ti 



3) The Gosset lattice E s : 
1 



4) The Leech lattice A24: 

e A24 (g) = l(Mqf + Mqf + Mq) s 

16 



From dHJ, we need to minimize 
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Thus to minimize Eve's probability of correct decision is 
equivalent to minimize 0a c (z) in z = i/27r<jg. To approach 
this problem, let us set y = —iz and restrict to real positive 
values of y. We are now interested in minimizing 



e Ae 0/) = E s l|rf > 



\y >o, 



rGA c 



in the particular value of y corresponding to z = i/2nol, 
namely 



1 



y = 



2ira? ' 



This is actually a problem that classically arises in the study of 
theta series |2|: given the lattice dimension n, find the lattice 
A* that minimizes Q A {y) for a given value of y. 

Note that if A e is not chosen to be a particular lattice, we 
can assume that A e = Z n , We consequently define the secrecy 
function of a given lattice A as the ratio of its theta series and 
the theta series of Z n , in a chosen point y. 

Definition 1: Let A be an n— dimensional lattice. The se- 
crecy function of A is given by 

„ _ QzAv) _ Mv) n 

e A (y) Q A (y) 

defined for y > 0. 

As we want to minimize the expression of Eve's probability 
of correct decision in ®, we are interested in the maximum 
value of the secrecy function. This yields the notion of secrecy 
gain. 

Definition 2: The secrecy gain xa of an n— dimensional 
lattice A is defined by 



XA 



sup E A (y). 



w 1 1.15 




Fig. 1, Secrecy function of Eg. 
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Fig. 2. Secrecy function of Dg. 



Examples of the secrecy function for the lattices Eg and 
D$ are shown in Figures Q] and [2] respectively. Both lattices 
clearly have a maximum, happening in y = 1 for E$ but not 
for Ds (which is conjectured to have this maximum in -^=). 

It is worth emphasizing that the value at which the secrecy 
function gets its maximum is important for the code design, 
since it tells us what is the SNR at which the wiretap lattice 
code is providing most confusion to Eve. The two examples 
suggest that this value depends on the chosen lattice. 

Conjectures on the behaviour of the secrecy gain are cur- 
rently being investigated. It is expected that an asymptotic 
analysis will give a first insight, and that a finer study should 
reveal how the secrecy gain is connected to the equivocation 
rate. 

Let us conclude by giving a small example of code con- 
struction. 

Example 3: Consider the case of an 8— dimensional (real) 
construction. Suppose we want to transmit at a secrecy rate of 
2 bits per complex symbol. We choose Ab — Es, since this 
lattice has the best coding gain and the best shaping gain in 
dimension 8. For A e , we choose as sublattice of Eg the lattice 
2E$, a scaled version of A&. We then have 



|£ 8 /2i; 8 | = 256 



which gives as rate per complex symbol 

R= ^\og 2 \E 8 /2E s \ = 2 

which is the requested rate. 

To construct Eg while preserving the overall shaping, we 
choose a construction A flTJ : 

Eg = 2Z 8 + (8,4,4) 

where (8, 4, 4) stands for the Reed-Miiller code of length 8 
and dimension 4. We repeat the same construction for 2Eg, 
namely 

2E S = 4Z 8 + 2- (8,4,4). 

We can now give a construction of Eg using 2E S : 

Eg =2E 8 + (8,4,4) + 2 • C t 

where C| is the set of all representatives of the cosets of 
(8, 4, 4) with minimum Hamming weights. This yields 

E 8 /2E S = (8,4,4) + 2 -Of 

which gives an alphabet with 256 codewords. 

Then, the random bits label 2Eg, which means that 4 of 
these bits serve as information bits for 2 • (8, 4, 4) and the 
other ones label points of 4Z 8 . 

It has been proved [2 |, and this is the best result known up to 
date, that some lattices, including Eg, reach a local minimum 
of their theta series for some constant y > close to 1 . Thus 
using A e = 2Eg indeed helps in optimizing the secrecy gain. 

V. Current and future work 

In this paper, we provided a practical wiretap coding scheme 
using coset lattice codes. We exhibited geometric properties 
that a lattice and its sublattice should satisfy to provide good 
wiretap codes for transmission over additive white Gaussian 
noise channels, in terms of the theta series of the involved 
lattices. This yielded the notion of secrecy gain. Our analysis 
focuses on error probabilities of both users rather than on 
equivocation rate, though we expect that further work will 
enlighten the connection between the two concepts. 

We are currently studying different conjectures on the 
behaviour of the secrecy gain, as well as the design of lattice 



codes that fullfil the code design criteria. Having explicit 
constructions of families of wiretap codes to compare will give 
us a further understanding of what is a good wiretap lattice 
code. It is also a natural work to address the achievability of 
such codes with respect to the secrecy capacity of Gaussian 
channels. 

Finally, lattice codes have also been useful to design mod- 
ulation schemes for fading channels. It is a natural general- 
ization to consider a similar analysis of what makes a good 
wiretap code in the context of fading channels. 
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